promote: dev to main

.cursor/skills/opencodex-fork-sync/SKILL.md

@@ -69,6 +69,21 @@ fast-forward of `upstream/main`; `vendor/dev` remains an exact fast-forward of
 branch. The issue notifier is selected by `FORK_SYNC_NOTIFIERS=github-issue`;
 the Cursor coordinator is selected by `FORK_SYNC_COORDINATORS=cursor-webhook`.
 
+Keep the PR readable while the automation works. Maintain exactly one sticky
+progress comment with marker `<!-- cursor-sync-progress -->` and one matching
+PR-body section between `<!-- cursor-sync-progress:start -->` and
+`<!-- cursor-sync-progress:end -->`. Update both in place after every push,
+never post a new comment. Inside each, render a 4-line checklist in this order:
+
+1. Merge `vendor/main` TAG/SHA - done or pending
+2. Resolve shared hotspot per `OWNED.md` - done or pending (name the files)
+3. Rebase onto `origin/dev` - `MERGEABLE` or `not a descendant of origin/dev` with recovery `git merge origin/dev` and re-push
+4. CI `ci` / `enforce-target` / `hygiene` - each with `pass` / `fail` and the
+   exact code (`new_suppression`, `unsponsored_surface`, shard name) when failing
+
+When all gates are `MERGEABLE` and hygiene is green, flip Draft -> Ready for
+review and post `Ready for human merge - do not squash/rebase.` Stop.
+
 Cursor is the first coordinator, not the only supported integration. The
 registry accepts comma-separated IDs and can run multiple coordinators, for
 example `FORK_SYNC_COORDINATORS=cursor-webhook,http`.

.cursor/skills/opencodex-fork-sync/automation-prompt.md

@@ -29,11 +29,23 @@ Execute only the unresolved handoff stages:
    commands.
 7. Push the sync branch as needed and open or update a draft PR into `dev`.
    Fill Summary, Verification, and Checklist from the PR template. Include the
-   decision table and the tag SHA. Run
+   decision table and the tag SHA. Inside the PR body, maintain a sticky
+   section between `<!-- cursor-sync-progress:start -->` and
+   `<!-- cursor-sync-progress:end -->` with the 4-line checklist:
+   (1) Merge `vendor/main` TAG/SHA, (2) Resolve shared hotspot per
+   `OWNED.md`, (3) Rebase onto `origin/dev` (`MERGEABLE` or
+   `not a descendant` + `git merge origin/dev`), (4) CI
+   `ci`/`enforce-target`/`hygiene` with exact failing codes. Mirror the same
+   checklist in exactly one sticky comment marked
+   `<!-- cursor-sync-progress -->` - update it in place after every push,
+   never create a new one. Run
    `gh pr view <number> --json mergeable -q .mergeable` and do not stop or ping
    the human until it reports `MERGEABLE`.
-8. Stop. The human performs the merge commit, never squash or rebase. Do not
-   merge the PR, close issues, change repository settings, or force-push
+8. Until `MERGEABLE` and hygiene green, stay and supervise. After every push, poll `gh pr view <number> --json mergeable` and `gh pr checks` every 60s for 10m. If `not a descendant of origin/dev`, run `git fetch origin dev && git merge --no-edit origin/dev && git push` yourself. For `macos-launchd` timeout-only flakes, run `gh run rerun --failed` once. Update the sticky PR-body section and the single `<!-- cursor-sync-progress -->` comment in place (never a new comment) with the 4-line checklist and exact failing codes. Only `new_suppression` / `unsponsored_surface` need `suppression-approved` / `maintainer-sponsored` human waive - report the blocker but do not auto-waive.
+9. When all gates are `MERGEABLE` and hygiene green, flip Draft -> Ready
+   for review and post `Ready for human merge - do not squash/rebase.` Stop.
+   The human performs the merge commit, never squash or rebase. Do not merge
+   the PR, close issues, change repository settings, or force-push
    `main`/`origin/main`.
 
 If histories diverge again, use the disconnected `run/dev` rebuild only as an

.github/scripts/agent-maintenance.cjs

@@ -195,6 +195,45 @@ function maintenanceReadyEvidence({
   };
 }
 
+function autonomousMergeEvidence({
+  pr,
+  checkRuns = [],
+  headCommit,
+  expectedJulesUserId,
+  authorizedSessionId,
+  sessionId,
+  expectedBugbotAppId,
+  expectedChecksAppId = 15368,
+  requiredNames = ["ci", "enforce-target", "hygiene"],
+  labels = (pr?.labels || []),
+}) {
+  const names = new Set(labels.map((label) => typeof label === "string" ? label : label?.name));
+  const headSha = pr?.head?.sha;
+  const julesId = Number(expectedJulesUserId);
+  const sessionKey = (value) => String(value ?? "").replace(/^sessions\//, "");
+  const authorized = authorizedSessionId && sessionKey(sessionId) === sessionKey(authorizedSessionId);
+  const prByJules = Number.isSafeInteger(julesId) && julesId > 0 && Number(pr?.user?.id) === julesId;
+  const authoredByJules = Number.isSafeInteger(julesId) && julesId > 0 &&
+    [headCommit?.author?.id, headCommit?.committer?.id].some((id) => Number(id) === julesId);
+  const baselineReady = requiredChecksSuccessful(checkRuns, headSha, requiredNames, expectedChecksAppId);
+  const bugbotEvidence = exactHeadBugbotEvidence({
+    checkRuns,
+    liveHeadSha: headSha,
+    expectedAppId: expectedBugbotAppId,
+  });
+  return {
+    autonomousLabel: names.has("autonomous-fix"),
+    baselineReady,
+    bugbotEvidence,
+    authorizedSession: Boolean(authorized),
+    prByJules: Boolean(prByJules),
+    authoredByJules: Boolean(prByJules && authoredByJules && headCommit?.sha === headSha),
+    ready: pr?.state === "open" && pr?.base?.ref === "dev" && names.has("autonomous-fix") &&
+      baselineReady && Boolean(bugbotEvidence) && Boolean(authorized) &&
+      Boolean(prByJules && authoredByJules && headCommit?.sha === headSha),
+  };
+}
+
 function trustedActiveMaintenanceCount(records) {
   return records.filter((record) =>
     record?.error ||
@@ -386,6 +425,19 @@ function createJulesClient({ apiKey, fetchImpl = fetch, sleep = (ms) => new Prom
     return assertSession(await request(`/sessions/${encodeURIComponent(id)}`));
   }
 
+  async function sendMessage(id, prompt) {
+    if (!/^[^/]+$/.test(id)) throw new Error("invalid Jules session resource id");
+    if (!prompt || typeof prompt !== "string") throw new Error("sendMessage requires a prompt string");
+    return request(`/sessions/${encodeURIComponent(id)}:sendMessage`, { method: "POST", body: { prompt }, retryReads: false });
+  }
+
+  async function listSessionActivities(id) {
+    if (!/^[^/]+$/.test(id)) throw new Error("invalid Jules session resource id");
+    const result = await request(`/sessions/${encodeURIComponent(id)}/activities`);
+    if (!result || !Array.isArray(result.activities)) return [];
+    return result.activities;
+  }
+
   async function createSessionIdempotently(payload) {
     try {
       return await createSession(payload);
@@ -420,6 +472,8 @@ function createJulesClient({ apiKey, fetchImpl = fetch, sleep = (ms) => new Prom
     createSession,
     createSessionIdempotently,
     getSession,
+    listSessionActivities,
+    sendMessage,
     listSessions,
     listSources,
   };
@@ -439,6 +493,7 @@ module.exports = {
   exactHeadBugbotEvidence,
   generatedSyncBaselineDisposition,
   maintenanceReadyEvidence,
+  autonomousMergeEvidence,
   findGithubSource,
   hasExactHeadMaintainerWaiver,
   isExpectedJulesHeadAdvance,

.github/scripts/agent-maintenance.test.cjs

@@ -11,6 +11,7 @@ const {
   exactHeadBugbotEvidence,
   generatedSyncBaselineDisposition,
   maintenanceReadyEvidence,
+  autonomousMergeEvidence,
   findGithubSource,
   hasExactHeadMaintainerWaiver,
   isExpectedJulesHeadAdvance,
@@ -196,6 +197,66 @@ describe("maintenance PR readiness", () => {
   });
 });
 
+describe("autonomous merge evidence", () => {
+  const pr = {
+    number: 42,
+    state: "open",
+    base: { ref: "dev" },
+    user: { id: 77 },
+    head: { sha: SHA },
+    labels: [{ name: "autonomous-fix" }],
+  };
+  const checks = [
+    ...["ci", "enforce-target", "hygiene"].map((name, id) => ({
+      id: id + 1, name, app: { id: 15368 }, head_sha: SHA,
+      status: "completed", conclusion: "success",
+    })),
+    { id: 4, name: "Cursor Bugbot", app: { id: 99 }, head_sha: SHA,
+      status: "completed", conclusion: "success" },
+  ];
+  const valid = {
+    pr,
+    checkRuns: checks,
+    headCommit: { sha: SHA, author: { id: 77 }, committer: { id: 77 } },
+    expectedJulesUserId: 77,
+    expectedBugbotAppId: 99,
+    authorizedSessionId: "sessions/abc",
+    sessionId: "sessions/abc",
+  };
+
+  it("accepts a labeled exact-head Jules fix with all required checks", () => {
+    const result = autonomousMergeEvidence(valid);
+    assert.equal(result.ready, true);
+    assert.equal(result.bugbotEvidence.checkRunId, 4);
+  });
+
+  it("rejects a waiver or missing autonomous-fix label", () => {
+    assert.equal(autonomousMergeEvidence({
+      ...valid,
+      checkRuns: checks.slice(0, 3),
+      labels: ["review-bot-waived"],
+      reviews: [
+        { id: 1, user: { login: "alice" }, commit_id: SHA, state: "APPROVED" },
+        { id: 2, user: { login: "carol" }, commit_id: SHA, state: "APPROVED" },
+      ],
+      maintainers: ["alice", "carol"],
+    }).ready, false);
+    assert.equal(autonomousMergeEvidence({ ...valid, pr: { ...pr, labels: [] } }).ready, false);
+  });
+
+  it("rejects stale checks, unauthorized session, and non-Jules head authorship", () => {
+    assert.equal(autonomousMergeEvidence({ ...valid, sessionId: "sessions/other" }).ready, false);
+    assert.equal(autonomousMergeEvidence({
+      ...valid,
+      headCommit: { ...valid.headCommit, sha: "b".repeat(40) },
+    }).ready, false);
+    assert.equal(autonomousMergeEvidence({
+      ...valid,
+      checkRuns: checks.map(check => check.name === "ci" ? { ...check, conclusion: "failure" } : check),
+    }).ready, false);
+  });
+});
+
 describe("controller fail-closed helpers", () => {
   it("uses the latest labeled or unlabeled event for an active dispatch label", () => {
     const events = [